1 // SPDX-License-Identifier: LGPL-2.1
2 /*
3 *
4 * SMB/CIFS session setup handling routines
5 *
6 * Copyright (c) International Business Machines Corp., 2006, 2009
7 * Author(s): Steve French (sfrench@us.ibm.com)
8 *
9 */
10
11 #include "cifspdu.h"
12 #include "cifsglob.h"
13 #include "cifsproto.h"
14 #include "cifs_unicode.h"
15 #include "cifs_debug.h"
16 #include "ntlmssp.h"
17 #include "nterr.h"
18 #include <linux/utsname.h>
19 #include <linux/slab.h>
20 #include <linux/version.h>
21 #include "cifsfs.h"
22 #include "cifs_spnego.h"
23 #include "smb2proto.h"
24 #include "fs_context.h"
25
26 static int
27 cifs_ses_add_channel(struct cifs_ses *ses,
28 struct cifs_server_iface *iface);
29
is_ses_using_iface(struct cifs_ses * ses,struct cifs_server_iface * iface)30 bool is_ses_using_iface(struct cifs_ses *ses, struct cifs_server_iface *iface)
31 {
32 int i;
33
34 spin_lock(&ses->chan_lock);
35 for (i = 0; i < ses->chan_count; i++) {
36 if (ses->chans[i].iface == iface) {
37 spin_unlock(&ses->chan_lock);
38 return true;
39 }
40 }
41 spin_unlock(&ses->chan_lock);
42 return false;
43 }
44
45 /* channel helper functions. assumed that chan_lock is held by caller. */
46
47 int
cifs_ses_get_chan_index(struct cifs_ses * ses,struct TCP_Server_Info * server)48 cifs_ses_get_chan_index(struct cifs_ses *ses,
49 struct TCP_Server_Info *server)
50 {
51 unsigned int i;
52
53 /* if the channel is waiting for termination */
54 if (server && server->terminate)
55 return CIFS_INVAL_CHAN_INDEX;
56
57 for (i = 0; i < ses->chan_count; i++) {
58 if (ses->chans[i].server == server)
59 return i;
60 }
61
62 /* If we didn't find the channel, it is likely a bug */
63 if (server)
64 cifs_dbg(VFS, "unable to get chan index for server: 0x%llx",
65 server->conn_id);
66 return CIFS_INVAL_CHAN_INDEX;
67 }
68
69 void
cifs_chan_set_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)70 cifs_chan_set_in_reconnect(struct cifs_ses *ses,
71 struct TCP_Server_Info *server)
72 {
73 int chan_index = cifs_ses_get_chan_index(ses, server);
74
75 if (chan_index == CIFS_INVAL_CHAN_INDEX)
76 return;
77
78 ses->chans[chan_index].in_reconnect = true;
79 }
80
81 void
cifs_chan_clear_in_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)82 cifs_chan_clear_in_reconnect(struct cifs_ses *ses,
83 struct TCP_Server_Info *server)
84 {
85 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
86
87 if (chan_index == CIFS_INVAL_CHAN_INDEX)
88 return;
89
90 ses->chans[chan_index].in_reconnect = false;
91 }
92
93 void
cifs_chan_set_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)94 cifs_chan_set_need_reconnect(struct cifs_ses *ses,
95 struct TCP_Server_Info *server)
96 {
97 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
98
99 if (chan_index == CIFS_INVAL_CHAN_INDEX)
100 return;
101
102 set_bit(chan_index, &ses->chans_need_reconnect);
103 cifs_dbg(FYI, "Set reconnect bitmask for chan %u; now 0x%lx\n",
104 chan_index, ses->chans_need_reconnect);
105 }
106
107 void
cifs_chan_clear_need_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)108 cifs_chan_clear_need_reconnect(struct cifs_ses *ses,
109 struct TCP_Server_Info *server)
110 {
111 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
112
113 if (chan_index == CIFS_INVAL_CHAN_INDEX)
114 return;
115
116 clear_bit(chan_index, &ses->chans_need_reconnect);
117 cifs_dbg(FYI, "Cleared reconnect bitmask for chan %u; now 0x%lx\n",
118 chan_index, ses->chans_need_reconnect);
119 }
120
121 bool
cifs_chan_needs_reconnect(struct cifs_ses * ses,struct TCP_Server_Info * server)122 cifs_chan_needs_reconnect(struct cifs_ses *ses,
123 struct TCP_Server_Info *server)
124 {
125 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
126
127 if (chan_index == CIFS_INVAL_CHAN_INDEX)
128 return true; /* err on the safer side */
129
130 return CIFS_CHAN_NEEDS_RECONNECT(ses, chan_index);
131 }
132
133 bool
cifs_chan_is_iface_active(struct cifs_ses * ses,struct TCP_Server_Info * server)134 cifs_chan_is_iface_active(struct cifs_ses *ses,
135 struct TCP_Server_Info *server)
136 {
137 unsigned int chan_index = cifs_ses_get_chan_index(ses, server);
138
139 if (chan_index == CIFS_INVAL_CHAN_INDEX)
140 return true; /* err on the safer side */
141
142 return ses->chans[chan_index].iface &&
143 ses->chans[chan_index].iface->is_active;
144 }
145
146 /* returns number of channels added */
cifs_try_adding_channels(struct cifs_ses * ses)147 int cifs_try_adding_channels(struct cifs_ses *ses)
148 {
149 struct TCP_Server_Info *server = ses->server;
150 int old_chan_count, new_chan_count;
151 int left;
152 int rc = 0;
153 int tries = 0;
154 size_t iface_weight = 0, iface_min_speed = 0;
155 struct cifs_server_iface *iface = NULL, *niface = NULL;
156 struct cifs_server_iface *last_iface = NULL;
157
158 spin_lock(&ses->chan_lock);
159
160 new_chan_count = old_chan_count = ses->chan_count;
161 left = ses->chan_max - ses->chan_count;
162
163 if (left <= 0) {
164 spin_unlock(&ses->chan_lock);
165 cifs_dbg(FYI,
166 "ses already at max_channels (%zu), nothing to open\n",
167 ses->chan_max);
168 return 0;
169 }
170
171 if (server->dialect < SMB30_PROT_ID) {
172 spin_unlock(&ses->chan_lock);
173 cifs_dbg(VFS, "multichannel is not supported on this protocol version, use 3.0 or above\n");
174 return 0;
175 }
176
177 if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
178 spin_unlock(&ses->chan_lock);
179 cifs_server_dbg(VFS, "no multichannel support\n");
180 return 0;
181 }
182 spin_unlock(&ses->chan_lock);
183
184 while (left > 0) {
185
186 tries++;
187 if (tries > 3*ses->chan_max) {
188 cifs_dbg(VFS, "too many channel open attempts (%d channels left to open)\n",
189 left);
190 break;
191 }
192
193 spin_lock(&ses->iface_lock);
194 if (!ses->iface_count) {
195 spin_unlock(&ses->iface_lock);
196 cifs_dbg(ONCE, "server %s does not advertise interfaces\n",
197 ses->server->hostname);
198 break;
199 }
200
201 if (!iface)
202 iface = list_first_entry(&ses->iface_list, struct cifs_server_iface,
203 iface_head);
204 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
205 iface_head);
206 iface_min_speed = last_iface->speed;
207
208 list_for_each_entry_safe_from(iface, niface, &ses->iface_list,
209 iface_head) {
210 /* do not mix rdma and non-rdma interfaces */
211 if (iface->rdma_capable != ses->server->rdma)
212 continue;
213
214 /* skip ifaces that are unusable */
215 if (!iface->is_active ||
216 (is_ses_using_iface(ses, iface) &&
217 !iface->rss_capable))
218 continue;
219
220 /* check if we already allocated enough channels */
221 iface_weight = iface->speed / iface_min_speed;
222
223 if (iface->weight_fulfilled >= iface_weight)
224 continue;
225
226 /* take ref before unlock */
227 kref_get(&iface->refcount);
228
229 spin_unlock(&ses->iface_lock);
230 rc = cifs_ses_add_channel(ses, iface);
231 spin_lock(&ses->iface_lock);
232
233 if (rc) {
234 cifs_dbg(VFS, "failed to open extra channel on iface:%pIS rc=%d\n",
235 &iface->sockaddr,
236 rc);
237 kref_put(&iface->refcount, release_iface);
238 /* failure to add chan should increase weight */
239 iface->weight_fulfilled++;
240 continue;
241 }
242
243 iface->num_channels++;
244 iface->weight_fulfilled++;
245 cifs_dbg(VFS, "successfully opened new channel on iface:%pIS\n",
246 &iface->sockaddr);
247 break;
248 }
249
250 /* reached end of list. reset weight_fulfilled and start over */
251 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
252 list_for_each_entry(iface, &ses->iface_list, iface_head)
253 iface->weight_fulfilled = 0;
254 spin_unlock(&ses->iface_lock);
255 iface = NULL;
256 continue;
257 }
258 spin_unlock(&ses->iface_lock);
259
260 left--;
261 new_chan_count++;
262 }
263
264 return new_chan_count - old_chan_count;
265 }
266
267 /*
268 * called when multichannel is disabled by the server.
269 * this always gets called from smb2_reconnect
270 * and cannot get called in parallel threads.
271 */
272 void
cifs_disable_secondary_channels(struct cifs_ses * ses)273 cifs_disable_secondary_channels(struct cifs_ses *ses)
274 {
275 int i, chan_count;
276 struct TCP_Server_Info *server;
277 struct cifs_server_iface *iface;
278
279 spin_lock(&ses->chan_lock);
280 chan_count = ses->chan_count;
281 if (chan_count == 1)
282 goto done;
283
284 ses->chan_count = 1;
285
286 /* for all secondary channels reset the need reconnect bit */
287 ses->chans_need_reconnect &= 1;
288
289 for (i = 1; i < chan_count; i++) {
290 iface = ses->chans[i].iface;
291 server = ses->chans[i].server;
292
293 /*
294 * remove these references first, since we need to unlock
295 * the chan_lock here, since iface_lock is a higher lock
296 */
297 ses->chans[i].iface = NULL;
298 ses->chans[i].server = NULL;
299 spin_unlock(&ses->chan_lock);
300
301 if (iface) {
302 spin_lock(&ses->iface_lock);
303 iface->num_channels--;
304 if (iface->weight_fulfilled)
305 iface->weight_fulfilled--;
306 kref_put(&iface->refcount, release_iface);
307 spin_unlock(&ses->iface_lock);
308 }
309
310 if (server) {
311 if (!server->terminate) {
312 server->terminate = true;
313 cifs_signal_cifsd_for_reconnect(server, false);
314 }
315 cifs_put_tcp_session(server, false);
316 }
317
318 spin_lock(&ses->chan_lock);
319 }
320
321 done:
322 spin_unlock(&ses->chan_lock);
323 }
324
325 /* update the iface for the channel if necessary. */
326 void
cifs_chan_update_iface(struct cifs_ses * ses,struct TCP_Server_Info * server)327 cifs_chan_update_iface(struct cifs_ses *ses, struct TCP_Server_Info *server)
328 {
329 unsigned int chan_index;
330 size_t iface_weight = 0, iface_min_speed = 0;
331 struct cifs_server_iface *iface = NULL;
332 struct cifs_server_iface *old_iface = NULL;
333 struct cifs_server_iface *last_iface = NULL;
334 struct sockaddr_storage ss;
335
336 spin_lock(&ses->chan_lock);
337 chan_index = cifs_ses_get_chan_index(ses, server);
338 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
339 spin_unlock(&ses->chan_lock);
340 return;
341 }
342
343 if (ses->chans[chan_index].iface) {
344 old_iface = ses->chans[chan_index].iface;
345 if (old_iface->is_active) {
346 spin_unlock(&ses->chan_lock);
347 return;
348 }
349 }
350 spin_unlock(&ses->chan_lock);
351
352 spin_lock(&server->srv_lock);
353 ss = server->dstaddr;
354 spin_unlock(&server->srv_lock);
355
356 spin_lock(&ses->iface_lock);
357 if (!ses->iface_count) {
358 spin_unlock(&ses->iface_lock);
359 cifs_dbg(ONCE, "server %s does not advertise interfaces\n", ses->server->hostname);
360 return;
361 }
362
363 last_iface = list_last_entry(&ses->iface_list, struct cifs_server_iface,
364 iface_head);
365 iface_min_speed = last_iface->speed;
366
367 /* then look for a new one */
368 list_for_each_entry(iface, &ses->iface_list, iface_head) {
369 if (!chan_index) {
370 /* if we're trying to get the updated iface for primary channel */
371 if (!cifs_match_ipaddr((struct sockaddr *) &ss,
372 (struct sockaddr *) &iface->sockaddr))
373 continue;
374
375 kref_get(&iface->refcount);
376 break;
377 }
378
379 /* do not mix rdma and non-rdma interfaces */
380 if (iface->rdma_capable != server->rdma)
381 continue;
382
383 if (!iface->is_active ||
384 (is_ses_using_iface(ses, iface) &&
385 !iface->rss_capable)) {
386 continue;
387 }
388
389 /* check if we already allocated enough channels */
390 iface_weight = iface->speed / iface_min_speed;
391
392 if (iface->weight_fulfilled >= iface_weight)
393 continue;
394
395 kref_get(&iface->refcount);
396 break;
397 }
398
399 if (list_entry_is_head(iface, &ses->iface_list, iface_head)) {
400 iface = NULL;
401 cifs_dbg(FYI, "unable to find a suitable iface\n");
402 }
403
404 if (!iface) {
405 if (!chan_index)
406 cifs_dbg(FYI, "unable to get the interface matching: %pIS\n",
407 &ss);
408 else {
409 cifs_dbg(FYI, "unable to find another interface to replace: %pIS\n",
410 &old_iface->sockaddr);
411 }
412
413 spin_unlock(&ses->iface_lock);
414 return;
415 }
416
417 /* now drop the ref to the current iface */
418 if (old_iface) {
419 cifs_dbg(FYI, "replacing iface: %pIS with %pIS\n",
420 &old_iface->sockaddr,
421 &iface->sockaddr);
422
423 old_iface->num_channels--;
424 if (old_iface->weight_fulfilled)
425 old_iface->weight_fulfilled--;
426 iface->num_channels++;
427 iface->weight_fulfilled++;
428
429 kref_put(&old_iface->refcount, release_iface);
430 } else if (!chan_index) {
431 /* special case: update interface for primary channel */
432 cifs_dbg(FYI, "referencing primary channel iface: %pIS\n",
433 &iface->sockaddr);
434 iface->num_channels++;
435 iface->weight_fulfilled++;
436 }
437 spin_unlock(&ses->iface_lock);
438
439 spin_lock(&ses->chan_lock);
440 chan_index = cifs_ses_get_chan_index(ses, server);
441 if (chan_index == CIFS_INVAL_CHAN_INDEX) {
442 spin_unlock(&ses->chan_lock);
443 return;
444 }
445
446 ses->chans[chan_index].iface = iface;
447 spin_unlock(&ses->chan_lock);
448 }
449
450 static int
cifs_ses_add_channel(struct cifs_ses * ses,struct cifs_server_iface * iface)451 cifs_ses_add_channel(struct cifs_ses *ses,
452 struct cifs_server_iface *iface)
453 {
454 struct TCP_Server_Info *chan_server;
455 struct cifs_chan *chan;
456 struct smb3_fs_context *ctx;
457 static const char unc_fmt[] = "\\%s\\foo";
458 struct sockaddr_in *ipv4 = (struct sockaddr_in *)&iface->sockaddr;
459 struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)&iface->sockaddr;
460 size_t len;
461 int rc;
462 unsigned int xid = get_xid();
463
464 if (iface->sockaddr.ss_family == AF_INET)
465 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI4)\n",
466 ses, iface->speed, str_yes_no(iface->rdma_capable),
467 &ipv4->sin_addr);
468 else
469 cifs_dbg(FYI, "adding channel to ses %p (speed:%zu bps rdma:%s ip:%pI6)\n",
470 ses, iface->speed, str_yes_no(iface->rdma_capable),
471 &ipv6->sin6_addr);
472
473 /*
474 * Setup a ctx with mostly the same info as the existing
475 * session and overwrite it with the requested iface data.
476 *
477 * We need to setup at least the fields used for negprot and
478 * sesssetup.
479 *
480 * We only need the ctx here, so we can reuse memory from
481 * the session and server without caring about memory
482 * management.
483 */
484 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
485 if (!ctx) {
486 rc = -ENOMEM;
487 goto out_free_xid;
488 }
489
490 /* Always make new connection for now (TODO?) */
491 ctx->nosharesock = true;
492
493 /* Auth */
494 ctx->domainauto = ses->domainAuto;
495 ctx->domainname = ses->domainName;
496
497 /* no hostname for extra channels */
498 ctx->server_hostname = "";
499
500 ctx->username = ses->user_name;
501 ctx->password = ses->password;
502 ctx->sectype = ses->sectype;
503 ctx->sign = ses->sign;
504
505 /* UNC and paths */
506 /* XXX: Use ses->server->hostname? */
507 len = sizeof(unc_fmt) + SERVER_NAME_LEN_WITH_NULL;
508 ctx->UNC = kzalloc(len, GFP_KERNEL);
509 if (!ctx->UNC) {
510 rc = -ENOMEM;
511 goto out_free_ctx;
512 }
513 scnprintf(ctx->UNC, len, unc_fmt, ses->ip_addr);
514 ctx->prepath = "";
515
516 /* Reuse same version as master connection */
517 ctx->vals = ses->server->vals;
518 ctx->ops = ses->server->ops;
519
520 ctx->noblocksnd = ses->server->noblocksnd;
521 ctx->noautotune = ses->server->noautotune;
522 ctx->sockopt_tcp_nodelay = ses->server->tcp_nodelay;
523 ctx->echo_interval = ses->server->echo_interval / HZ;
524 ctx->max_credits = ses->server->max_credits;
525
526 /*
527 * This will be used for encoding/decoding user/domain/pw
528 * during sess setup auth.
529 */
530 ctx->local_nls = ses->local_nls;
531
532 /* Use RDMA if possible */
533 ctx->rdma = iface->rdma_capable;
534 memcpy(&ctx->dstaddr, &iface->sockaddr, sizeof(ctx->dstaddr));
535
536 /* reuse master con client guid */
537 memcpy(&ctx->client_guid, ses->server->client_guid,
538 sizeof(ctx->client_guid));
539 ctx->use_client_guid = true;
540
541 chan_server = cifs_get_tcp_session(ctx, ses->server);
542
543 spin_lock(&ses->chan_lock);
544 chan = &ses->chans[ses->chan_count];
545 chan->server = chan_server;
546 if (IS_ERR(chan->server)) {
547 rc = PTR_ERR(chan->server);
548 chan->server = NULL;
549 spin_unlock(&ses->chan_lock);
550 goto out;
551 }
552 chan->iface = iface;
553 ses->chan_count++;
554 atomic_set(&ses->chan_seq, 0);
555
556 /* Mark this channel as needing connect/setup */
557 cifs_chan_set_need_reconnect(ses, chan->server);
558
559 spin_unlock(&ses->chan_lock);
560
561 mutex_lock(&ses->session_mutex);
562 /*
563 * We need to allocate the server crypto now as we will need
564 * to sign packets before we generate the channel signing key
565 * (we sign with the session key)
566 */
567 rc = smb311_crypto_shash_allocate(chan->server);
568 if (rc) {
569 cifs_dbg(VFS, "%s: crypto alloc failed\n", __func__);
570 mutex_unlock(&ses->session_mutex);
571 goto out;
572 }
573
574 rc = cifs_negotiate_protocol(xid, ses, chan->server);
575 if (!rc)
576 rc = cifs_setup_session(xid, ses, chan->server, ses->local_nls);
577
578 mutex_unlock(&ses->session_mutex);
579
580 out:
581 if (rc && chan->server) {
582 cifs_put_tcp_session(chan->server, 0);
583
584 spin_lock(&ses->chan_lock);
585
586 /* we rely on all bits beyond chan_count to be clear */
587 cifs_chan_clear_need_reconnect(ses, chan->server);
588 ses->chan_count--;
589 /*
590 * chan_count should never reach 0 as at least the primary
591 * channel is always allocated
592 */
593 WARN_ON(ses->chan_count < 1);
594 spin_unlock(&ses->chan_lock);
595 }
596
597 kfree(ctx->UNC);
598 out_free_ctx:
599 kfree(ctx);
600 out_free_xid:
601 free_xid(xid);
602 return rc;
603 }
604
605 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
cifs_ssetup_hdr(struct cifs_ses * ses,struct TCP_Server_Info * server,SESSION_SETUP_ANDX * pSMB)606 static __u32 cifs_ssetup_hdr(struct cifs_ses *ses,
607 struct TCP_Server_Info *server,
608 SESSION_SETUP_ANDX *pSMB)
609 {
610 __u32 capabilities = 0;
611
612 /* init fields common to all four types of SessSetup */
613 /* Note that offsets for first seven fields in req struct are same */
614 /* in CIFS Specs so does not matter which of 3 forms of struct */
615 /* that we use in next few lines */
616 /* Note that header is initialized to zero in header_assemble */
617 pSMB->req.AndXCommand = 0xFF;
618 pSMB->req.MaxBufferSize = cpu_to_le16(min_t(u32,
619 CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4,
620 USHRT_MAX));
621 pSMB->req.MaxMpxCount = cpu_to_le16(server->maxReq);
622 pSMB->req.VcNumber = cpu_to_le16(1);
623
624 /* Now no need to set SMBFLG_CASELESS or obsolete CANONICAL PATH */
625
626 /* BB verify whether signing required on neg or just auth frame (and NTLM case) */
627
628 capabilities = CAP_LARGE_FILES | CAP_NT_SMBS | CAP_LEVEL_II_OPLOCKS |
629 CAP_LARGE_WRITE_X | CAP_LARGE_READ_X;
630
631 if (server->sign)
632 pSMB->req.hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
633
634 if (ses->capabilities & CAP_UNICODE) {
635 pSMB->req.hdr.Flags2 |= SMBFLG2_UNICODE;
636 capabilities |= CAP_UNICODE;
637 }
638 if (ses->capabilities & CAP_STATUS32) {
639 pSMB->req.hdr.Flags2 |= SMBFLG2_ERR_STATUS;
640 capabilities |= CAP_STATUS32;
641 }
642 if (ses->capabilities & CAP_DFS) {
643 pSMB->req.hdr.Flags2 |= SMBFLG2_DFS;
644 capabilities |= CAP_DFS;
645 }
646 if (ses->capabilities & CAP_UNIX)
647 capabilities |= CAP_UNIX;
648
649 return capabilities;
650 }
651
652 static void
unicode_oslm_strings(char ** pbcc_area,const struct nls_table * nls_cp)653 unicode_oslm_strings(char **pbcc_area, const struct nls_table *nls_cp)
654 {
655 char *bcc_ptr = *pbcc_area;
656 int bytes_ret = 0;
657
658 /* Copy OS version */
659 bytes_ret = cifs_strtoUTF16((__le16 *)bcc_ptr, "Linux version ", 32,
660 nls_cp);
661 bcc_ptr += 2 * bytes_ret;
662 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, init_utsname()->release,
663 32, nls_cp);
664 bcc_ptr += 2 * bytes_ret;
665 bcc_ptr += 2; /* trailing null */
666
667 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, CIFS_NETWORK_OPSYS,
668 32, nls_cp);
669 bcc_ptr += 2 * bytes_ret;
670 bcc_ptr += 2; /* trailing null */
671
672 *pbcc_area = bcc_ptr;
673 }
674
unicode_domain_string(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)675 static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
676 const struct nls_table *nls_cp)
677 {
678 char *bcc_ptr = *pbcc_area;
679 int bytes_ret = 0;
680
681 /* copy domain */
682 if (ses->domainName == NULL) {
683 /*
684 * Sending null domain better than using a bogus domain name (as
685 * we did briefly in 2.6.18) since server will use its default
686 */
687 *bcc_ptr = 0;
688 *(bcc_ptr+1) = 0;
689 bytes_ret = 0;
690 } else
691 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->domainName,
692 CIFS_MAX_DOMAINNAME_LEN, nls_cp);
693 bcc_ptr += 2 * bytes_ret;
694 bcc_ptr += 2; /* account for null terminator */
695
696 *pbcc_area = bcc_ptr;
697 }
698
unicode_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)699 static void unicode_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
700 const struct nls_table *nls_cp)
701 {
702 char *bcc_ptr = *pbcc_area;
703 int bytes_ret = 0;
704
705 /* BB FIXME add check that strings less than 335 or will need to send as arrays */
706
707 /* copy user */
708 if (ses->user_name == NULL) {
709 /* null user mount */
710 *bcc_ptr = 0;
711 *(bcc_ptr+1) = 0;
712 } else {
713 bytes_ret = cifs_strtoUTF16((__le16 *) bcc_ptr, ses->user_name,
714 CIFS_MAX_USERNAME_LEN, nls_cp);
715 }
716 bcc_ptr += 2 * bytes_ret;
717 bcc_ptr += 2; /* account for null termination */
718
719 unicode_domain_string(&bcc_ptr, ses, nls_cp);
720 unicode_oslm_strings(&bcc_ptr, nls_cp);
721
722 *pbcc_area = bcc_ptr;
723 }
724
ascii_ssetup_strings(char ** pbcc_area,struct cifs_ses * ses,const struct nls_table * nls_cp)725 static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
726 const struct nls_table *nls_cp)
727 {
728 char *bcc_ptr = *pbcc_area;
729 int len;
730
731 /* copy user */
732 /* BB what about null user mounts - check that we do this BB */
733 /* copy user */
734 if (ses->user_name != NULL) {
735 len = strscpy(bcc_ptr, ses->user_name, CIFS_MAX_USERNAME_LEN);
736 if (WARN_ON_ONCE(len < 0))
737 len = CIFS_MAX_USERNAME_LEN - 1;
738 bcc_ptr += len;
739 }
740 /* else null user mount */
741 *bcc_ptr = 0;
742 bcc_ptr++; /* account for null termination */
743
744 /* copy domain */
745 if (ses->domainName != NULL) {
746 len = strscpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
747 if (WARN_ON_ONCE(len < 0))
748 len = CIFS_MAX_DOMAINNAME_LEN - 1;
749 bcc_ptr += len;
750 } /* else we send a null domain name so server will default to its own domain */
751 *bcc_ptr = 0;
752 bcc_ptr++;
753
754 /* BB check for overflow here */
755
756 strcpy(bcc_ptr, "Linux version ");
757 bcc_ptr += strlen("Linux version ");
758 strcpy(bcc_ptr, init_utsname()->release);
759 bcc_ptr += strlen(init_utsname()->release) + 1;
760
761 strcpy(bcc_ptr, CIFS_NETWORK_OPSYS);
762 bcc_ptr += strlen(CIFS_NETWORK_OPSYS) + 1;
763
764 *pbcc_area = bcc_ptr;
765 }
766
767 static void
decode_unicode_ssetup(char ** pbcc_area,int bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)768 decode_unicode_ssetup(char **pbcc_area, int bleft, struct cifs_ses *ses,
769 const struct nls_table *nls_cp)
770 {
771 int len;
772 char *data = *pbcc_area;
773
774 cifs_dbg(FYI, "bleft %d\n", bleft);
775
776 kfree(ses->serverOS);
777 ses->serverOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
778 cifs_dbg(FYI, "serverOS=%s\n", ses->serverOS);
779 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
780 data += len;
781 bleft -= len;
782 if (bleft <= 0)
783 return;
784
785 kfree(ses->serverNOS);
786 ses->serverNOS = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
787 cifs_dbg(FYI, "serverNOS=%s\n", ses->serverNOS);
788 len = (UniStrnlen((wchar_t *) data, bleft / 2) * 2) + 2;
789 data += len;
790 bleft -= len;
791 if (bleft <= 0)
792 return;
793
794 kfree(ses->serverDomain);
795 ses->serverDomain = cifs_strndup_from_utf16(data, bleft, true, nls_cp);
796 cifs_dbg(FYI, "serverDomain=%s\n", ses->serverDomain);
797
798 return;
799 }
800
decode_ascii_ssetup(char ** pbcc_area,__u16 bleft,struct cifs_ses * ses,const struct nls_table * nls_cp)801 static void decode_ascii_ssetup(char **pbcc_area, __u16 bleft,
802 struct cifs_ses *ses,
803 const struct nls_table *nls_cp)
804 {
805 int len;
806 char *bcc_ptr = *pbcc_area;
807
808 cifs_dbg(FYI, "decode sessetup ascii. bleft %d\n", bleft);
809
810 len = strnlen(bcc_ptr, bleft);
811 if (len >= bleft)
812 return;
813
814 kfree(ses->serverOS);
815
816 ses->serverOS = kmalloc(len + 1, GFP_KERNEL);
817 if (ses->serverOS) {
818 memcpy(ses->serverOS, bcc_ptr, len);
819 ses->serverOS[len] = 0;
820 if (strncmp(ses->serverOS, "OS/2", 4) == 0)
821 cifs_dbg(FYI, "OS/2 server\n");
822 }
823
824 bcc_ptr += len + 1;
825 bleft -= len + 1;
826
827 len = strnlen(bcc_ptr, bleft);
828 if (len >= bleft)
829 return;
830
831 kfree(ses->serverNOS);
832
833 ses->serverNOS = kmalloc(len + 1, GFP_KERNEL);
834 if (ses->serverNOS) {
835 memcpy(ses->serverNOS, bcc_ptr, len);
836 ses->serverNOS[len] = 0;
837 }
838
839 bcc_ptr += len + 1;
840 bleft -= len + 1;
841
842 len = strnlen(bcc_ptr, bleft);
843 if (len > bleft)
844 return;
845
846 /*
847 * No domain field in LANMAN case. Domain is
848 * returned by old servers in the SMB negprot response
849 *
850 * BB For newer servers which do not support Unicode,
851 * but thus do return domain here, we could add parsing
852 * for it later, but it is not very important
853 */
854 cifs_dbg(FYI, "ascii: bytes left %d\n", bleft);
855 }
856 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
857
decode_ntlmssp_challenge(char * bcc_ptr,int blob_len,struct cifs_ses * ses)858 int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
859 struct cifs_ses *ses)
860 {
861 unsigned int tioffset; /* challenge message target info area */
862 unsigned int tilen; /* challenge message target info area length */
863 CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
864 __u32 server_flags;
865
866 if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
867 cifs_dbg(VFS, "challenge blob len %d too small\n", blob_len);
868 return -EINVAL;
869 }
870
871 if (memcmp(pblob->Signature, "NTLMSSP", 8)) {
872 cifs_dbg(VFS, "blob signature incorrect %s\n",
873 pblob->Signature);
874 return -EINVAL;
875 }
876 if (pblob->MessageType != NtLmChallenge) {
877 cifs_dbg(VFS, "Incorrect message type %d\n",
878 pblob->MessageType);
879 return -EINVAL;
880 }
881
882 server_flags = le32_to_cpu(pblob->NegotiateFlags);
883 cifs_dbg(FYI, "%s: negotiate=0x%08x challenge=0x%08x\n", __func__,
884 ses->ntlmssp->client_flags, server_flags);
885
886 if ((ses->ntlmssp->client_flags & (NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN)) &&
887 (!(server_flags & NTLMSSP_NEGOTIATE_56) && !(server_flags & NTLMSSP_NEGOTIATE_128))) {
888 cifs_dbg(VFS, "%s: requested signing/encryption but server did not return either 56-bit or 128-bit session key size\n",
889 __func__);
890 return -EINVAL;
891 }
892 if (!(server_flags & NTLMSSP_NEGOTIATE_NTLM) && !(server_flags & NTLMSSP_NEGOTIATE_EXTENDED_SEC)) {
893 cifs_dbg(VFS, "%s: server does not seem to support either NTLMv1 or NTLMv2\n", __func__);
894 return -EINVAL;
895 }
896 if (ses->server->sign && !(server_flags & NTLMSSP_NEGOTIATE_SIGN)) {
897 cifs_dbg(VFS, "%s: forced packet signing but server does not seem to support it\n",
898 __func__);
899 return -EOPNOTSUPP;
900 }
901 if ((ses->ntlmssp->client_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
902 !(server_flags & NTLMSSP_NEGOTIATE_KEY_XCH))
903 pr_warn_once("%s: authentication has been weakened as server does not support key exchange\n",
904 __func__);
905
906 ses->ntlmssp->server_flags = server_flags;
907
908 memcpy(ses->ntlmssp->cryptkey, pblob->Challenge, CIFS_CRYPTO_KEY_SIZE);
909 /*
910 * In particular we can examine sign flags
911 *
912 * BB spec says that if AvId field of MsvAvTimestamp is populated then
913 * we must set the MIC field of the AUTHENTICATE_MESSAGE
914 */
915
916 tioffset = le32_to_cpu(pblob->TargetInfoArray.BufferOffset);
917 tilen = le16_to_cpu(pblob->TargetInfoArray.Length);
918 if (tioffset > blob_len || tioffset + tilen > blob_len) {
919 cifs_dbg(VFS, "tioffset + tilen too high %u + %u\n",
920 tioffset, tilen);
921 return -EINVAL;
922 }
923 if (tilen) {
924 kfree_sensitive(ses->auth_key.response);
925 ses->auth_key.response = kmemdup(bcc_ptr + tioffset, tilen,
926 GFP_KERNEL);
927 if (!ses->auth_key.response) {
928 cifs_dbg(VFS, "Challenge target info alloc failure\n");
929 return -ENOMEM;
930 }
931 ses->auth_key.len = tilen;
932 }
933
934 return 0;
935 }
936
size_of_ntlmssp_blob(struct cifs_ses * ses,int base_size)937 static int size_of_ntlmssp_blob(struct cifs_ses *ses, int base_size)
938 {
939 int sz = base_size + ses->auth_key.len
940 - CIFS_SESS_KEY_SIZE + CIFS_CPHTXT_SIZE + 2;
941
942 if (ses->domainName)
943 sz += sizeof(__le16) * strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
944 else
945 sz += sizeof(__le16);
946
947 if (ses->user_name)
948 sz += sizeof(__le16) * strnlen(ses->user_name, CIFS_MAX_USERNAME_LEN);
949 else
950 sz += sizeof(__le16);
951
952 if (ses->workstation_name[0])
953 sz += sizeof(__le16) * strnlen(ses->workstation_name,
954 ntlmssp_workstation_name_size(ses));
955 else
956 sz += sizeof(__le16);
957
958 return sz;
959 }
960
cifs_security_buffer_from_str(SECURITY_BUFFER * pbuf,char * str_value,int str_length,unsigned char * pstart,unsigned char ** pcur,const struct nls_table * nls_cp)961 static inline void cifs_security_buffer_from_str(SECURITY_BUFFER *pbuf,
962 char *str_value,
963 int str_length,
964 unsigned char *pstart,
965 unsigned char **pcur,
966 const struct nls_table *nls_cp)
967 {
968 unsigned char *tmp = pstart;
969 int len;
970
971 if (!pbuf)
972 return;
973
974 if (!pcur)
975 pcur = &tmp;
976
977 if (!str_value) {
978 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
979 pbuf->Length = 0;
980 pbuf->MaximumLength = 0;
981 *pcur += sizeof(__le16);
982 } else {
983 len = cifs_strtoUTF16((__le16 *)*pcur,
984 str_value,
985 str_length,
986 nls_cp);
987 len *= sizeof(__le16);
988 pbuf->BufferOffset = cpu_to_le32(*pcur - pstart);
989 pbuf->Length = cpu_to_le16(len);
990 pbuf->MaximumLength = cpu_to_le16(len);
991 *pcur += len;
992 }
993 }
994
995 /* BB Move to ntlmssp.c eventually */
996
build_ntlmssp_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)997 int build_ntlmssp_negotiate_blob(unsigned char **pbuffer,
998 u16 *buflen,
999 struct cifs_ses *ses,
1000 struct TCP_Server_Info *server,
1001 const struct nls_table *nls_cp)
1002 {
1003 int rc = 0;
1004 NEGOTIATE_MESSAGE *sec_blob;
1005 __u32 flags;
1006 unsigned char *tmp;
1007 int len;
1008
1009 len = size_of_ntlmssp_blob(ses, sizeof(NEGOTIATE_MESSAGE));
1010 *pbuffer = kmalloc(len, GFP_KERNEL);
1011 if (!*pbuffer) {
1012 rc = -ENOMEM;
1013 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1014 *buflen = 0;
1015 goto setup_ntlm_neg_ret;
1016 }
1017 sec_blob = (NEGOTIATE_MESSAGE *)*pbuffer;
1018
1019 memset(*pbuffer, 0, sizeof(NEGOTIATE_MESSAGE));
1020 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1021 sec_blob->MessageType = NtLmNegotiate;
1022
1023 /* BB is NTLMV2 session security format easier to use here? */
1024 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1025 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1026 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1027 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1028 NTLMSSP_NEGOTIATE_SIGN;
1029 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1030 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1031
1032 tmp = *pbuffer + sizeof(NEGOTIATE_MESSAGE);
1033 ses->ntlmssp->client_flags = flags;
1034 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1035
1036 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1037 cifs_security_buffer_from_str(&sec_blob->DomainName,
1038 NULL,
1039 CIFS_MAX_DOMAINNAME_LEN,
1040 *pbuffer, &tmp,
1041 nls_cp);
1042
1043 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1044 NULL,
1045 CIFS_MAX_WORKSTATION_LEN,
1046 *pbuffer, &tmp,
1047 nls_cp);
1048
1049 *buflen = tmp - *pbuffer;
1050 setup_ntlm_neg_ret:
1051 return rc;
1052 }
1053
1054 /*
1055 * Build ntlmssp blob with additional fields, such as version,
1056 * supported by modern servers. For safety limit to SMB3 or later
1057 * See notes in MS-NLMP Section 2.2.2.1 e.g.
1058 */
build_ntlmssp_smb3_negotiate_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1059 int build_ntlmssp_smb3_negotiate_blob(unsigned char **pbuffer,
1060 u16 *buflen,
1061 struct cifs_ses *ses,
1062 struct TCP_Server_Info *server,
1063 const struct nls_table *nls_cp)
1064 {
1065 int rc = 0;
1066 struct negotiate_message *sec_blob;
1067 __u32 flags;
1068 unsigned char *tmp;
1069 int len;
1070
1071 len = size_of_ntlmssp_blob(ses, sizeof(struct negotiate_message));
1072 *pbuffer = kmalloc(len, GFP_KERNEL);
1073 if (!*pbuffer) {
1074 rc = -ENOMEM;
1075 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1076 *buflen = 0;
1077 goto setup_ntlm_smb3_neg_ret;
1078 }
1079 sec_blob = (struct negotiate_message *)*pbuffer;
1080
1081 memset(*pbuffer, 0, sizeof(struct negotiate_message));
1082 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1083 sec_blob->MessageType = NtLmNegotiate;
1084
1085 /* BB is NTLMV2 session security format easier to use here? */
1086 flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET |
1087 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
1088 NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC |
1089 NTLMSSP_NEGOTIATE_ALWAYS_SIGN | NTLMSSP_NEGOTIATE_SEAL |
1090 NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_VERSION;
1091 if (!server->session_estab || ses->ntlmssp->sesskey_per_smbsess)
1092 flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
1093
1094 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1095 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1096 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1097 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1098
1099 tmp = *pbuffer + sizeof(struct negotiate_message);
1100 ses->ntlmssp->client_flags = flags;
1101 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1102
1103 /* these fields should be null in negotiate phase MS-NLMP 3.1.5.1.1 */
1104 cifs_security_buffer_from_str(&sec_blob->DomainName,
1105 NULL,
1106 CIFS_MAX_DOMAINNAME_LEN,
1107 *pbuffer, &tmp,
1108 nls_cp);
1109
1110 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1111 NULL,
1112 CIFS_MAX_WORKSTATION_LEN,
1113 *pbuffer, &tmp,
1114 nls_cp);
1115
1116 *buflen = tmp - *pbuffer;
1117 setup_ntlm_smb3_neg_ret:
1118 return rc;
1119 }
1120
1121
1122 /* See MS-NLMP 2.2.1.3 */
build_ntlmssp_auth_blob(unsigned char ** pbuffer,u16 * buflen,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1123 int build_ntlmssp_auth_blob(unsigned char **pbuffer,
1124 u16 *buflen,
1125 struct cifs_ses *ses,
1126 struct TCP_Server_Info *server,
1127 const struct nls_table *nls_cp)
1128 {
1129 int rc;
1130 AUTHENTICATE_MESSAGE *sec_blob;
1131 __u32 flags;
1132 unsigned char *tmp;
1133 int len;
1134
1135 rc = setup_ntlmv2_rsp(ses, nls_cp);
1136 if (rc) {
1137 cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc);
1138 *buflen = 0;
1139 goto setup_ntlmv2_ret;
1140 }
1141
1142 len = size_of_ntlmssp_blob(ses, sizeof(AUTHENTICATE_MESSAGE));
1143 *pbuffer = kmalloc(len, GFP_KERNEL);
1144 if (!*pbuffer) {
1145 rc = -ENOMEM;
1146 cifs_dbg(VFS, "Error %d during NTLMSSP allocation\n", rc);
1147 *buflen = 0;
1148 goto setup_ntlmv2_ret;
1149 }
1150 sec_blob = (AUTHENTICATE_MESSAGE *)*pbuffer;
1151
1152 memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
1153 sec_blob->MessageType = NtLmAuthenticate;
1154
1155 /* send version information in ntlmssp authenticate also */
1156 flags = ses->ntlmssp->server_flags | NTLMSSP_REQUEST_TARGET |
1157 NTLMSSP_NEGOTIATE_TARGET_INFO | NTLMSSP_NEGOTIATE_VERSION |
1158 NTLMSSP_NEGOTIATE_WORKSTATION_SUPPLIED;
1159
1160 sec_blob->Version.ProductMajorVersion = LINUX_VERSION_MAJOR;
1161 sec_blob->Version.ProductMinorVersion = LINUX_VERSION_PATCHLEVEL;
1162 sec_blob->Version.ProductBuild = cpu_to_le16(SMB3_PRODUCT_BUILD);
1163 sec_blob->Version.NTLMRevisionCurrent = NTLMSSP_REVISION_W2K3;
1164
1165 tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE);
1166 sec_blob->NegotiateFlags = cpu_to_le32(flags);
1167
1168 sec_blob->LmChallengeResponse.BufferOffset =
1169 cpu_to_le32(sizeof(AUTHENTICATE_MESSAGE));
1170 sec_blob->LmChallengeResponse.Length = 0;
1171 sec_blob->LmChallengeResponse.MaximumLength = 0;
1172
1173 sec_blob->NtChallengeResponse.BufferOffset =
1174 cpu_to_le32(tmp - *pbuffer);
1175 if (ses->user_name != NULL) {
1176 memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1177 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1178 tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1179
1180 sec_blob->NtChallengeResponse.Length =
1181 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1182 sec_blob->NtChallengeResponse.MaximumLength =
1183 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1184 } else {
1185 /*
1186 * don't send an NT Response for anonymous access
1187 */
1188 sec_blob->NtChallengeResponse.Length = 0;
1189 sec_blob->NtChallengeResponse.MaximumLength = 0;
1190 }
1191
1192 cifs_security_buffer_from_str(&sec_blob->DomainName,
1193 ses->domainName,
1194 CIFS_MAX_DOMAINNAME_LEN,
1195 *pbuffer, &tmp,
1196 nls_cp);
1197
1198 cifs_security_buffer_from_str(&sec_blob->UserName,
1199 ses->user_name,
1200 CIFS_MAX_USERNAME_LEN,
1201 *pbuffer, &tmp,
1202 nls_cp);
1203
1204 cifs_security_buffer_from_str(&sec_blob->WorkstationName,
1205 ses->workstation_name,
1206 ntlmssp_workstation_name_size(ses),
1207 *pbuffer, &tmp,
1208 nls_cp);
1209
1210 if ((ses->ntlmssp->server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
1211 (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) &&
1212 !calc_seckey(ses)) {
1213 memcpy(tmp, ses->ntlmssp->ciphertext, CIFS_CPHTXT_SIZE);
1214 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1215 sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
1216 sec_blob->SessionKey.MaximumLength =
1217 cpu_to_le16(CIFS_CPHTXT_SIZE);
1218 tmp += CIFS_CPHTXT_SIZE;
1219 } else {
1220 sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - *pbuffer);
1221 sec_blob->SessionKey.Length = 0;
1222 sec_blob->SessionKey.MaximumLength = 0;
1223 }
1224
1225 *buflen = tmp - *pbuffer;
1226 setup_ntlmv2_ret:
1227 return rc;
1228 }
1229
1230 enum securityEnum
cifs_select_sectype(struct TCP_Server_Info * server,enum securityEnum requested)1231 cifs_select_sectype(struct TCP_Server_Info *server, enum securityEnum requested)
1232 {
1233 switch (server->negflavor) {
1234 case CIFS_NEGFLAVOR_EXTENDED:
1235 switch (requested) {
1236 case Kerberos:
1237 case RawNTLMSSP:
1238 return requested;
1239 case Unspecified:
1240 if (server->sec_ntlmssp &&
1241 (global_secflags & CIFSSEC_MAY_NTLMSSP))
1242 return RawNTLMSSP;
1243 if ((server->sec_kerberos || server->sec_mskerberos) &&
1244 (global_secflags & CIFSSEC_MAY_KRB5))
1245 return Kerberos;
1246 fallthrough;
1247 default:
1248 return Unspecified;
1249 }
1250 case CIFS_NEGFLAVOR_UNENCAP:
1251 switch (requested) {
1252 case NTLMv2:
1253 return requested;
1254 case Unspecified:
1255 if (global_secflags & CIFSSEC_MAY_NTLMV2)
1256 return NTLMv2;
1257 break;
1258 default:
1259 break;
1260 }
1261 fallthrough;
1262 default:
1263 return Unspecified;
1264 }
1265 }
1266
1267 struct sess_data {
1268 unsigned int xid;
1269 struct cifs_ses *ses;
1270 struct TCP_Server_Info *server;
1271 struct nls_table *nls_cp;
1272 void (*func)(struct sess_data *);
1273 int result;
1274
1275 /* we will send the SMB in three pieces:
1276 * a fixed length beginning part, an optional
1277 * SPNEGO blob (which can be zero length), and a
1278 * last part which will include the strings
1279 * and rest of bcc area. This allows us to avoid
1280 * a large buffer 17K allocation
1281 */
1282 int buf0_type;
1283 struct kvec iov[3];
1284 };
1285
1286 #ifdef CONFIG_CIFS_ALLOW_INSECURE_LEGACY
1287 static int
sess_alloc_buffer(struct sess_data * sess_data,int wct)1288 sess_alloc_buffer(struct sess_data *sess_data, int wct)
1289 {
1290 int rc;
1291 struct cifs_ses *ses = sess_data->ses;
1292 struct smb_hdr *smb_buf;
1293
1294 rc = small_smb_init_no_tc(SMB_COM_SESSION_SETUP_ANDX, wct, ses,
1295 (void **)&smb_buf);
1296
1297 if (rc)
1298 return rc;
1299
1300 sess_data->iov[0].iov_base = (char *)smb_buf;
1301 sess_data->iov[0].iov_len = be32_to_cpu(smb_buf->smb_buf_length) + 4;
1302 /*
1303 * This variable will be used to clear the buffer
1304 * allocated above in case of any error in the calling function.
1305 */
1306 sess_data->buf0_type = CIFS_SMALL_BUFFER;
1307
1308 /* 2000 big enough to fit max user, domain, NOS name etc. */
1309 sess_data->iov[2].iov_base = kmalloc(2000, GFP_KERNEL);
1310 if (!sess_data->iov[2].iov_base) {
1311 rc = -ENOMEM;
1312 goto out_free_smb_buf;
1313 }
1314
1315 return 0;
1316
1317 out_free_smb_buf:
1318 cifs_small_buf_release(smb_buf);
1319 sess_data->iov[0].iov_base = NULL;
1320 sess_data->iov[0].iov_len = 0;
1321 sess_data->buf0_type = CIFS_NO_BUFFER;
1322 return rc;
1323 }
1324
1325 static void
sess_free_buffer(struct sess_data * sess_data)1326 sess_free_buffer(struct sess_data *sess_data)
1327 {
1328 struct kvec *iov = sess_data->iov;
1329
1330 /*
1331 * Zero the session data before freeing, as it might contain sensitive info (keys, etc).
1332 * Note that iov[1] is already freed by caller.
1333 */
1334 if (sess_data->buf0_type != CIFS_NO_BUFFER && iov[0].iov_base)
1335 memzero_explicit(iov[0].iov_base, iov[0].iov_len);
1336
1337 free_rsp_buf(sess_data->buf0_type, iov[0].iov_base);
1338 sess_data->buf0_type = CIFS_NO_BUFFER;
1339 kfree_sensitive(iov[2].iov_base);
1340 }
1341
1342 static int
sess_establish_session(struct sess_data * sess_data)1343 sess_establish_session(struct sess_data *sess_data)
1344 {
1345 struct cifs_ses *ses = sess_data->ses;
1346 struct TCP_Server_Info *server = sess_data->server;
1347
1348 cifs_server_lock(server);
1349 if (!server->session_estab) {
1350 if (server->sign) {
1351 server->session_key.response =
1352 kmemdup(ses->auth_key.response,
1353 ses->auth_key.len, GFP_KERNEL);
1354 if (!server->session_key.response) {
1355 cifs_server_unlock(server);
1356 return -ENOMEM;
1357 }
1358 server->session_key.len =
1359 ses->auth_key.len;
1360 }
1361 server->sequence_number = 0x2;
1362 server->session_estab = true;
1363 }
1364 cifs_server_unlock(server);
1365
1366 cifs_dbg(FYI, "CIFS session established successfully\n");
1367 return 0;
1368 }
1369
1370 static int
sess_sendreceive(struct sess_data * sess_data)1371 sess_sendreceive(struct sess_data *sess_data)
1372 {
1373 int rc;
1374 struct smb_hdr *smb_buf = (struct smb_hdr *) sess_data->iov[0].iov_base;
1375 __u16 count;
1376 struct kvec rsp_iov = { NULL, 0 };
1377
1378 count = sess_data->iov[1].iov_len + sess_data->iov[2].iov_len;
1379 be32_add_cpu(&smb_buf->smb_buf_length, count);
1380 put_bcc(count, smb_buf);
1381
1382 rc = SendReceive2(sess_data->xid, sess_data->ses,
1383 sess_data->iov, 3 /* num_iovecs */,
1384 &sess_data->buf0_type,
1385 CIFS_LOG_ERROR, &rsp_iov);
1386 cifs_small_buf_release(sess_data->iov[0].iov_base);
1387 memcpy(&sess_data->iov[0], &rsp_iov, sizeof(struct kvec));
1388
1389 return rc;
1390 }
1391
1392 static void
sess_auth_ntlmv2(struct sess_data * sess_data)1393 sess_auth_ntlmv2(struct sess_data *sess_data)
1394 {
1395 int rc = 0;
1396 struct smb_hdr *smb_buf;
1397 SESSION_SETUP_ANDX *pSMB;
1398 char *bcc_ptr;
1399 struct cifs_ses *ses = sess_data->ses;
1400 struct TCP_Server_Info *server = sess_data->server;
1401 __u32 capabilities;
1402 __u16 bytes_remaining;
1403
1404 /* old style NTLM sessionsetup */
1405 /* wct = 13 */
1406 rc = sess_alloc_buffer(sess_data, 13);
1407 if (rc)
1408 goto out;
1409
1410 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1411 bcc_ptr = sess_data->iov[2].iov_base;
1412 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1413
1414 pSMB->req_no_secext.Capabilities = cpu_to_le32(capabilities);
1415
1416 /* LM2 password would be here if we supported it */
1417 pSMB->req_no_secext.CaseInsensitivePasswordLength = 0;
1418
1419 if (ses->user_name != NULL) {
1420 /* calculate nlmv2 response and session key */
1421 rc = setup_ntlmv2_rsp(ses, sess_data->nls_cp);
1422 if (rc) {
1423 cifs_dbg(VFS, "Error %d during NTLMv2 authentication\n", rc);
1424 goto out;
1425 }
1426
1427 memcpy(bcc_ptr, ses->auth_key.response + CIFS_SESS_KEY_SIZE,
1428 ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1429 bcc_ptr += ses->auth_key.len - CIFS_SESS_KEY_SIZE;
1430
1431 /* set case sensitive password length after tilen may get
1432 * assigned, tilen is 0 otherwise.
1433 */
1434 pSMB->req_no_secext.CaseSensitivePasswordLength =
1435 cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE);
1436 } else {
1437 pSMB->req_no_secext.CaseSensitivePasswordLength = 0;
1438 }
1439
1440 if (ses->capabilities & CAP_UNICODE) {
1441 if (!IS_ALIGNED(sess_data->iov[0].iov_len, 2)) {
1442 *bcc_ptr = 0;
1443 bcc_ptr++;
1444 }
1445 unicode_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1446 } else {
1447 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1448 }
1449
1450
1451 sess_data->iov[2].iov_len = (long) bcc_ptr -
1452 (long) sess_data->iov[2].iov_base;
1453
1454 rc = sess_sendreceive(sess_data);
1455 if (rc)
1456 goto out;
1457
1458 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1459 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1460
1461 if (smb_buf->WordCount != 3) {
1462 rc = -EIO;
1463 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1464 goto out;
1465 }
1466
1467 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1468 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1469
1470 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1471 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1472
1473 bytes_remaining = get_bcc(smb_buf);
1474 bcc_ptr = pByteArea(smb_buf);
1475
1476 /* BB check if Unicode and decode strings */
1477 if (bytes_remaining == 0) {
1478 /* no string area to decode, do nothing */
1479 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1480 /* unicode string area must be word-aligned */
1481 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1482 ++bcc_ptr;
1483 --bytes_remaining;
1484 }
1485 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1486 sess_data->nls_cp);
1487 } else {
1488 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1489 sess_data->nls_cp);
1490 }
1491
1492 rc = sess_establish_session(sess_data);
1493 out:
1494 sess_data->result = rc;
1495 sess_data->func = NULL;
1496 sess_free_buffer(sess_data);
1497 kfree_sensitive(ses->auth_key.response);
1498 ses->auth_key.response = NULL;
1499 }
1500
1501 #ifdef CONFIG_CIFS_UPCALL
1502 static void
sess_auth_kerberos(struct sess_data * sess_data)1503 sess_auth_kerberos(struct sess_data *sess_data)
1504 {
1505 int rc = 0;
1506 struct smb_hdr *smb_buf;
1507 SESSION_SETUP_ANDX *pSMB;
1508 char *bcc_ptr;
1509 struct cifs_ses *ses = sess_data->ses;
1510 struct TCP_Server_Info *server = sess_data->server;
1511 __u32 capabilities;
1512 __u16 bytes_remaining;
1513 struct key *spnego_key = NULL;
1514 struct cifs_spnego_msg *msg;
1515 u16 blob_len;
1516
1517 /* extended security */
1518 /* wct = 12 */
1519 rc = sess_alloc_buffer(sess_data, 12);
1520 if (rc)
1521 goto out;
1522
1523 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1524 bcc_ptr = sess_data->iov[2].iov_base;
1525 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1526
1527 spnego_key = cifs_get_spnego_key(ses, server);
1528 if (IS_ERR(spnego_key)) {
1529 rc = PTR_ERR(spnego_key);
1530 spnego_key = NULL;
1531 goto out;
1532 }
1533
1534 msg = spnego_key->payload.data[0];
1535 /*
1536 * check version field to make sure that cifs.upcall is
1537 * sending us a response in an expected form
1538 */
1539 if (msg->version != CIFS_SPNEGO_UPCALL_VERSION) {
1540 cifs_dbg(VFS, "incorrect version of cifs.upcall (expected %d but got %d)\n",
1541 CIFS_SPNEGO_UPCALL_VERSION, msg->version);
1542 rc = -EKEYREJECTED;
1543 goto out_put_spnego_key;
1544 }
1545
1546 kfree_sensitive(ses->auth_key.response);
1547 ses->auth_key.response = kmemdup(msg->data, msg->sesskey_len,
1548 GFP_KERNEL);
1549 if (!ses->auth_key.response) {
1550 cifs_dbg(VFS, "Kerberos can't allocate (%u bytes) memory\n",
1551 msg->sesskey_len);
1552 rc = -ENOMEM;
1553 goto out_put_spnego_key;
1554 }
1555 ses->auth_key.len = msg->sesskey_len;
1556
1557 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1558 capabilities |= CAP_EXTENDED_SECURITY;
1559 pSMB->req.Capabilities = cpu_to_le32(capabilities);
1560 sess_data->iov[1].iov_base = msg->data + msg->sesskey_len;
1561 sess_data->iov[1].iov_len = msg->secblob_len;
1562 pSMB->req.SecurityBlobLength = cpu_to_le16(sess_data->iov[1].iov_len);
1563
1564 if (ses->capabilities & CAP_UNICODE) {
1565 /* unicode strings must be word aligned */
1566 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1567 *bcc_ptr = 0;
1568 bcc_ptr++;
1569 }
1570 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1571 unicode_domain_string(&bcc_ptr, ses, sess_data->nls_cp);
1572 } else {
1573 /* BB: is this right? */
1574 ascii_ssetup_strings(&bcc_ptr, ses, sess_data->nls_cp);
1575 }
1576
1577 sess_data->iov[2].iov_len = (long) bcc_ptr -
1578 (long) sess_data->iov[2].iov_base;
1579
1580 rc = sess_sendreceive(sess_data);
1581 if (rc)
1582 goto out_put_spnego_key;
1583
1584 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1585 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1586
1587 if (smb_buf->WordCount != 4) {
1588 rc = -EIO;
1589 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1590 goto out_put_spnego_key;
1591 }
1592
1593 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1594 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1595
1596 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1597 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1598
1599 bytes_remaining = get_bcc(smb_buf);
1600 bcc_ptr = pByteArea(smb_buf);
1601
1602 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1603 if (blob_len > bytes_remaining) {
1604 cifs_dbg(VFS, "bad security blob length %d\n",
1605 blob_len);
1606 rc = -EINVAL;
1607 goto out_put_spnego_key;
1608 }
1609 bcc_ptr += blob_len;
1610 bytes_remaining -= blob_len;
1611
1612 /* BB check if Unicode and decode strings */
1613 if (bytes_remaining == 0) {
1614 /* no string area to decode, do nothing */
1615 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1616 /* unicode string area must be word-aligned */
1617 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1618 ++bcc_ptr;
1619 --bytes_remaining;
1620 }
1621 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1622 sess_data->nls_cp);
1623 } else {
1624 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1625 sess_data->nls_cp);
1626 }
1627
1628 rc = sess_establish_session(sess_data);
1629 out_put_spnego_key:
1630 key_invalidate(spnego_key);
1631 key_put(spnego_key);
1632 out:
1633 sess_data->result = rc;
1634 sess_data->func = NULL;
1635 sess_free_buffer(sess_data);
1636 kfree_sensitive(ses->auth_key.response);
1637 ses->auth_key.response = NULL;
1638 }
1639
1640 #endif /* ! CONFIG_CIFS_UPCALL */
1641
1642 /*
1643 * The required kvec buffers have to be allocated before calling this
1644 * function.
1645 */
1646 static int
_sess_auth_rawntlmssp_assemble_req(struct sess_data * sess_data)1647 _sess_auth_rawntlmssp_assemble_req(struct sess_data *sess_data)
1648 {
1649 SESSION_SETUP_ANDX *pSMB;
1650 struct cifs_ses *ses = sess_data->ses;
1651 struct TCP_Server_Info *server = sess_data->server;
1652 __u32 capabilities;
1653 char *bcc_ptr;
1654
1655 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1656
1657 capabilities = cifs_ssetup_hdr(ses, server, pSMB);
1658 if ((pSMB->req.hdr.Flags2 & SMBFLG2_UNICODE) == 0) {
1659 cifs_dbg(VFS, "NTLMSSP requires Unicode support\n");
1660 return -ENOSYS;
1661 }
1662
1663 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
1664 capabilities |= CAP_EXTENDED_SECURITY;
1665 pSMB->req.Capabilities |= cpu_to_le32(capabilities);
1666
1667 bcc_ptr = sess_data->iov[2].iov_base;
1668 /* unicode strings must be word aligned */
1669 if (!IS_ALIGNED(sess_data->iov[0].iov_len + sess_data->iov[1].iov_len, 2)) {
1670 *bcc_ptr = 0;
1671 bcc_ptr++;
1672 }
1673 unicode_oslm_strings(&bcc_ptr, sess_data->nls_cp);
1674
1675 sess_data->iov[2].iov_len = (long) bcc_ptr -
1676 (long) sess_data->iov[2].iov_base;
1677
1678 return 0;
1679 }
1680
1681 static void
1682 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data);
1683
1684 static void
sess_auth_rawntlmssp_negotiate(struct sess_data * sess_data)1685 sess_auth_rawntlmssp_negotiate(struct sess_data *sess_data)
1686 {
1687 int rc;
1688 struct smb_hdr *smb_buf;
1689 SESSION_SETUP_ANDX *pSMB;
1690 struct cifs_ses *ses = sess_data->ses;
1691 struct TCP_Server_Info *server = sess_data->server;
1692 __u16 bytes_remaining;
1693 char *bcc_ptr;
1694 unsigned char *ntlmsspblob = NULL;
1695 u16 blob_len;
1696
1697 cifs_dbg(FYI, "rawntlmssp session setup negotiate phase\n");
1698
1699 /*
1700 * if memory allocation is successful, caller of this function
1701 * frees it.
1702 */
1703 ses->ntlmssp = kmalloc(sizeof(struct ntlmssp_auth), GFP_KERNEL);
1704 if (!ses->ntlmssp) {
1705 rc = -ENOMEM;
1706 goto out;
1707 }
1708 ses->ntlmssp->sesskey_per_smbsess = false;
1709
1710 /* wct = 12 */
1711 rc = sess_alloc_buffer(sess_data, 12);
1712 if (rc)
1713 goto out;
1714
1715 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1716
1717 /* Build security blob before we assemble the request */
1718 rc = build_ntlmssp_negotiate_blob(&ntlmsspblob,
1719 &blob_len, ses, server,
1720 sess_data->nls_cp);
1721 if (rc)
1722 goto out_free_ntlmsspblob;
1723
1724 sess_data->iov[1].iov_len = blob_len;
1725 sess_data->iov[1].iov_base = ntlmsspblob;
1726 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1727
1728 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1729 if (rc)
1730 goto out_free_ntlmsspblob;
1731
1732 rc = sess_sendreceive(sess_data);
1733
1734 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1735 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1736
1737 /* If true, rc here is expected and not an error */
1738 if (sess_data->buf0_type != CIFS_NO_BUFFER &&
1739 smb_buf->Status.CifsError ==
1740 cpu_to_le32(NT_STATUS_MORE_PROCESSING_REQUIRED))
1741 rc = 0;
1742
1743 if (rc)
1744 goto out_free_ntlmsspblob;
1745
1746 cifs_dbg(FYI, "rawntlmssp session setup challenge phase\n");
1747
1748 if (smb_buf->WordCount != 4) {
1749 rc = -EIO;
1750 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1751 goto out_free_ntlmsspblob;
1752 }
1753
1754 ses->Suid = smb_buf->Uid; /* UID left in wire format (le) */
1755 cifs_dbg(FYI, "UID = %llu\n", ses->Suid);
1756
1757 bytes_remaining = get_bcc(smb_buf);
1758 bcc_ptr = pByteArea(smb_buf);
1759
1760 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1761 if (blob_len > bytes_remaining) {
1762 cifs_dbg(VFS, "bad security blob length %d\n",
1763 blob_len);
1764 rc = -EINVAL;
1765 goto out_free_ntlmsspblob;
1766 }
1767
1768 rc = decode_ntlmssp_challenge(bcc_ptr, blob_len, ses);
1769
1770 out_free_ntlmsspblob:
1771 kfree_sensitive(ntlmsspblob);
1772 out:
1773 sess_free_buffer(sess_data);
1774
1775 if (!rc) {
1776 sess_data->func = sess_auth_rawntlmssp_authenticate;
1777 return;
1778 }
1779
1780 /* Else error. Cleanup */
1781 kfree_sensitive(ses->auth_key.response);
1782 ses->auth_key.response = NULL;
1783 kfree_sensitive(ses->ntlmssp);
1784 ses->ntlmssp = NULL;
1785
1786 sess_data->func = NULL;
1787 sess_data->result = rc;
1788 }
1789
1790 static void
sess_auth_rawntlmssp_authenticate(struct sess_data * sess_data)1791 sess_auth_rawntlmssp_authenticate(struct sess_data *sess_data)
1792 {
1793 int rc;
1794 struct smb_hdr *smb_buf;
1795 SESSION_SETUP_ANDX *pSMB;
1796 struct cifs_ses *ses = sess_data->ses;
1797 struct TCP_Server_Info *server = sess_data->server;
1798 __u16 bytes_remaining;
1799 char *bcc_ptr;
1800 unsigned char *ntlmsspblob = NULL;
1801 u16 blob_len;
1802
1803 cifs_dbg(FYI, "rawntlmssp session setup authenticate phase\n");
1804
1805 /* wct = 12 */
1806 rc = sess_alloc_buffer(sess_data, 12);
1807 if (rc)
1808 goto out;
1809
1810 /* Build security blob before we assemble the request */
1811 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1812 smb_buf = (struct smb_hdr *)pSMB;
1813 rc = build_ntlmssp_auth_blob(&ntlmsspblob,
1814 &blob_len, ses, server,
1815 sess_data->nls_cp);
1816 if (rc)
1817 goto out_free_ntlmsspblob;
1818 sess_data->iov[1].iov_len = blob_len;
1819 sess_data->iov[1].iov_base = ntlmsspblob;
1820 pSMB->req.SecurityBlobLength = cpu_to_le16(blob_len);
1821 /*
1822 * Make sure that we tell the server that we are using
1823 * the uid that it just gave us back on the response
1824 * (challenge)
1825 */
1826 smb_buf->Uid = ses->Suid;
1827
1828 rc = _sess_auth_rawntlmssp_assemble_req(sess_data);
1829 if (rc)
1830 goto out_free_ntlmsspblob;
1831
1832 rc = sess_sendreceive(sess_data);
1833 if (rc)
1834 goto out_free_ntlmsspblob;
1835
1836 pSMB = (SESSION_SETUP_ANDX *)sess_data->iov[0].iov_base;
1837 smb_buf = (struct smb_hdr *)sess_data->iov[0].iov_base;
1838 if (smb_buf->WordCount != 4) {
1839 rc = -EIO;
1840 cifs_dbg(VFS, "bad word count %d\n", smb_buf->WordCount);
1841 goto out_free_ntlmsspblob;
1842 }
1843
1844 if (le16_to_cpu(pSMB->resp.Action) & GUEST_LOGIN)
1845 cifs_dbg(FYI, "Guest login\n"); /* BB mark SesInfo struct? */
1846
1847 if (ses->Suid != smb_buf->Uid) {
1848 ses->Suid = smb_buf->Uid;
1849 cifs_dbg(FYI, "UID changed! new UID = %llu\n", ses->Suid);
1850 }
1851
1852 bytes_remaining = get_bcc(smb_buf);
1853 bcc_ptr = pByteArea(smb_buf);
1854 blob_len = le16_to_cpu(pSMB->resp.SecurityBlobLength);
1855 if (blob_len > bytes_remaining) {
1856 cifs_dbg(VFS, "bad security blob length %d\n",
1857 blob_len);
1858 rc = -EINVAL;
1859 goto out_free_ntlmsspblob;
1860 }
1861 bcc_ptr += blob_len;
1862 bytes_remaining -= blob_len;
1863
1864
1865 /* BB check if Unicode and decode strings */
1866 if (bytes_remaining == 0) {
1867 /* no string area to decode, do nothing */
1868 } else if (smb_buf->Flags2 & SMBFLG2_UNICODE) {
1869 /* unicode string area must be word-aligned */
1870 if (!IS_ALIGNED((unsigned long)bcc_ptr - (unsigned long)smb_buf, 2)) {
1871 ++bcc_ptr;
1872 --bytes_remaining;
1873 }
1874 decode_unicode_ssetup(&bcc_ptr, bytes_remaining, ses,
1875 sess_data->nls_cp);
1876 } else {
1877 decode_ascii_ssetup(&bcc_ptr, bytes_remaining, ses,
1878 sess_data->nls_cp);
1879 }
1880
1881 out_free_ntlmsspblob:
1882 kfree_sensitive(ntlmsspblob);
1883 out:
1884 sess_free_buffer(sess_data);
1885
1886 if (!rc)
1887 rc = sess_establish_session(sess_data);
1888
1889 /* Cleanup */
1890 kfree_sensitive(ses->auth_key.response);
1891 ses->auth_key.response = NULL;
1892 kfree_sensitive(ses->ntlmssp);
1893 ses->ntlmssp = NULL;
1894
1895 sess_data->func = NULL;
1896 sess_data->result = rc;
1897 }
1898
select_sec(struct sess_data * sess_data)1899 static int select_sec(struct sess_data *sess_data)
1900 {
1901 int type;
1902 struct cifs_ses *ses = sess_data->ses;
1903 struct TCP_Server_Info *server = sess_data->server;
1904
1905 type = cifs_select_sectype(server, ses->sectype);
1906 cifs_dbg(FYI, "sess setup type %d\n", type);
1907 if (type == Unspecified) {
1908 cifs_dbg(VFS, "Unable to select appropriate authentication method!\n");
1909 return -EINVAL;
1910 }
1911
1912 switch (type) {
1913 case NTLMv2:
1914 sess_data->func = sess_auth_ntlmv2;
1915 break;
1916 case Kerberos:
1917 #ifdef CONFIG_CIFS_UPCALL
1918 sess_data->func = sess_auth_kerberos;
1919 break;
1920 #else
1921 cifs_dbg(VFS, "Kerberos negotiated but upcall support disabled!\n");
1922 return -ENOSYS;
1923 #endif /* CONFIG_CIFS_UPCALL */
1924 case RawNTLMSSP:
1925 sess_data->func = sess_auth_rawntlmssp_negotiate;
1926 break;
1927 default:
1928 cifs_dbg(VFS, "secType %d not supported!\n", type);
1929 return -ENOSYS;
1930 }
1931
1932 return 0;
1933 }
1934
CIFS_SessSetup(const unsigned int xid,struct cifs_ses * ses,struct TCP_Server_Info * server,const struct nls_table * nls_cp)1935 int CIFS_SessSetup(const unsigned int xid, struct cifs_ses *ses,
1936 struct TCP_Server_Info *server,
1937 const struct nls_table *nls_cp)
1938 {
1939 int rc = 0;
1940 struct sess_data *sess_data;
1941
1942 if (ses == NULL) {
1943 WARN(1, "%s: ses == NULL!", __func__);
1944 return -EINVAL;
1945 }
1946
1947 sess_data = kzalloc(sizeof(struct sess_data), GFP_KERNEL);
1948 if (!sess_data)
1949 return -ENOMEM;
1950
1951 sess_data->xid = xid;
1952 sess_data->ses = ses;
1953 sess_data->server = server;
1954 sess_data->buf0_type = CIFS_NO_BUFFER;
1955 sess_data->nls_cp = (struct nls_table *) nls_cp;
1956
1957 rc = select_sec(sess_data);
1958 if (rc)
1959 goto out;
1960
1961 while (sess_data->func)
1962 sess_data->func(sess_data);
1963
1964 /* Store result before we free sess_data */
1965 rc = sess_data->result;
1966
1967 out:
1968 kfree_sensitive(sess_data);
1969 return rc;
1970 }
1971 #endif /* CONFIG_CIFS_ALLOW_INSECURE_LEGACY */
1972